@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/src/internal/oauth/connected-collection.ts

@@ -1,345 +0,0 @@
-import { Effect, Context, Layer } from "effect";
-
-import { OAuthConnectedCustody } from "./connected-custody";
-import { OAuthConnectedFlow } from "./connected-flow";
-import { OAuthConnectedState } from "./connected-state";
-import type * as STypes from "./connected-state";
-import { CurrentOAuthTransaction } from "./owner";
-import type { Row } from "./owner";
-import { OAuthQueryCompiler } from "./query-compiler";
-import { invariant, oauthIdentityKey } from "./state";
-
-export interface Candidates {
-  readonly jobs: ReadonlyArray<Row>;
-  readonly grants: ReadonlyArray<Row>;
-  readonly cohorts: ReadonlyArray<Row>;
-  readonly tuples: ReadonlyArray<Row>;
-}
-
-const make = Effect.gen(function* () {
-  const operations = yield* OAuthQueryCompiler;
-  const C = yield* OAuthConnectedCustody;
-  const F = yield* OAuthConnectedFlow;
-  const S = yield* OAuthConnectedState;
-
-  const { asc, eq, lte, sql } = operations;
-  const { connectedReferenceCondition } = operations;
-  const { both, col, equal } = operations;
-
-  const discover = Effect.fn("oauthConnected.collectionCandidates")(function* (
-    mapping: STypes.Mapping,
-    moduleId: string,
-    limit: number,
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-
-    const g = mapping.grant,
-      j = S.jobTable(mapping),
-      h = mapping.cohort,
-      at = yield* owner.now(mapping.clock);
-
-    const jobs =
-      j === undefined
-        ? { rows: [] }
-        : yield* owner.read(
-            j.table,
-            both(
-              eq(col(j.table, j.moduleId), moduleId),
-              eq(col(j.table, j.state), "Confirmed"),
-              lte(col(j.table, j.retentionUntil), mapping.clock.encodeInstant(at)),
-            ),
-            {
-              limit: limit + 1,
-              takeOnly: true,
-              observe: false,
-              lock: false,
-              orderBy: asc(col(j.table, j.jobId)),
-            },
-          );
-
-    const grants = yield* owner.read(
-      g.table,
-      both(
-        eq(col(g.table, g.moduleId), moduleId),
-        sql`${col(g.table, g.state)} in ('Disconnected','ReauthorizationRequired')`,
-        sql`${col(g.table, g.sealed)} is null`,
-        sql`${col(g.table, g.refreshWork)} <> 'Unresolved'`,
-        lte(col(g.table, g.retentionUntil), mapping.clock.encodeInstant(at)),
-        sql`${col(g.table, g.revocationJobId)} is null`,
-        sql`not exists(select 1 from ${mapping.admission.table} where ${col(mapping.admission.table, mapping.admission.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.admission.table, mapping.admission.grantId)} = ${col(g.table, g.grantId)})`,
-        sql`not exists(select 1 from ${mapping.command.table} where ${col(mapping.command.table, mapping.command.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.command.table, mapping.command.grantId)} = ${col(g.table, g.grantId)})`,
-        j === undefined
-          ? undefined
-          : sql`not exists(select 1 from ${j.table} where ${col(j.table, j.moduleId)} = ${col(g.table, g.moduleId)} and ${col(j.table, j.grantId)} = ${col(g.table, g.grantId)})`,
-      ),
-      {
-        limit: limit + 1,
-        takeOnly: true,
-        observe: false,
-        lock: false,
-        orderBy: asc(col(g.table, g.grantId)),
-      },
-    );
-
-    const cohorts =
-      j === undefined
-        ? { rows: [] }
-        : yield* owner.read(
-            h.table,
-            both(
-              equal(h.table, { [h.state]: "Blocked" }),
-              C.clearableCondition(
-                mapping,
-                sql`${col(h.table, h.cohortKey)}`,
-                sql`${col(h.table, h.clientKey)}`,
-              ),
-            ),
-            {
-              limit: limit + 1,
-              takeOnly: true,
-              observe: false,
-              lock: false,
-              orderBy: asc(col(h.table, h.cohortKey)),
-            },
-          );
-
-    const t = mapping.ownership.tuple;
-
-    const tuples =
-      mapping.externalReference === undefined
-        ? { rows: [] }
-        : yield* owner.read(
-            t.table,
-            both(
-              eq(col(t.table, t.state), "Owned"),
-              sql`not (${connectedReferenceCondition(mapping, sql`${col(t.table, t.identityKey)}`, { provider: sql`${col(t.table, t.provider)}`, issuer: sql`${col(t.table, t.issuer)}` })})`,
-              sql`not (${mapping.externalReference({ identityKey: sql`${col(t.table, t.identityKey)}`, subjectId: sql`${col(t.table, t.subjectId)}` })})`,
-            ),
-            {
-              limit: limit + 1,
-              takeOnly: true,
-              observe: false,
-              lock: false,
-              orderBy: asc(col(t.table, t.identityKey)),
-            },
-          );
-
-    return { jobs: jobs.rows, grants: grants.rows, cohorts: cohorts.rows, tuples: tuples.rows };
-  });
-
-  const collect = Effect.fn("oauthConnected.collect")(function* (
-    mapping: STypes.Mapping,
-    moduleId: string,
-    limit: number,
-    discovered: Candidates,
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-
-    let visited = 0,
-      removed = 0,
-      hasMore = false;
-
-    if (limit === 0) return { visited, removed, hasMore: true };
-
-    const g = mapping.grant,
-      j = S.jobTable(mapping),
-      h = mapping.cohort;
-
-    if (j !== undefined) {
-      const candidates = { rows: discovered.jobs };
-
-      hasMore = candidates.rows.length > limit;
-      for (const candidate of candidates.rows.slice(0, limit)) {
-        visited++;
-
-        const job = S.jobStorage.decode(candidate[j.snapshot]),
-          token = job.context.token;
-
-        const client = yield* S.client(mapping, token.configuration, false);
-
-        invariant(client !== undefined);
-        const tuple = yield* F.inspectTuple(mapping, token.identity);
-        const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
-
-        invariant(cohort.row !== undefined);
-        const grant = yield* S.readGrant(mapping, token.moduleId, token.grantId);
-
-        const read = yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), {
-            limit: 1,
-          }),
-          row = read.rows[0];
-
-        if (row === undefined) continue;
-        const native = yield* mapping.subjectId.toNative(token.subjectId);
-
-        invariant(
-          row[j.snapshot] === S.jobStorage.encode(job) &&
-            row[j.moduleId] === moduleId &&
-            row[j.identityKey] === tuple.key &&
-            row[j.clientKey] === client.id &&
-            row[j.cohortKey] === cohort.id &&
-            row[j.grantId] === token.grantId &&
-            mapping.subjectId.equals(row[j.subjectId], native),
-        );
-
-        const now = yield* owner.now(mapping.clock),
-          until = mapping.clock.decodeInstant(row[j.retentionUntil]);
-
-        if (row[j.state] !== "Confirmed" || now < until) continue;
-        if (grant?.row[g.revocationJobId] === job.context.jobId) {
-          const summary = S.summaryStorage.decode(grant.row[g.summary]);
-
-          yield* owner.update(
-            g.table,
-            { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },
-            {
-              [g.revocationJobId]: null,
-              [g.summary]: S.summaryStorage.encode({ ...summary, remoteRevocation: "Confirmed" }),
-              [g.version]: owner.marker,
-            },
-          );
-        }
-        yield* owner.remove(j.table, {
-          [j.jobId]: job.context.jobId,
-          [j.state]: "Confirmed",
-          [j.version]: row[j.version],
-        });
-        owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${until}`);
-        removed++;
-      }
-    }
-    if (visited < limit) {
-      const candidates = { rows: discovered.grants };
-      const remaining = limit - visited;
-
-      if (candidates.rows.length > remaining) hasMore = true;
-      for (const candidate of candidates.rows.slice(0, remaining)) {
-        visited++;
-        const context = S.tokenContextStorage.decode(candidate[g.context]);
-        const client = yield* S.client(mapping, context.configuration, false);
-
-        invariant(client !== undefined);
-        const tuple = yield* F.inspectTuple(mapping, context.identity);
-        const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
-
-        invariant(cohort.row !== undefined);
-        const grant = yield* S.readGrant(mapping, moduleId, context.grantId);
-
-        if (grant === undefined) continue;
-
-        const now = yield* owner.now(mapping.clock),
-          until = mapping.clock.decodeInstant(grant.row[g.retentionUntil]);
-
-        if (
-          !["Disconnected", "ReauthorizationRequired"].includes(grant.row[g.state]) ||
-          grant.row[g.sealed] !== null ||
-          grant.row[g.refreshWork] === "Unresolved" ||
-          grant.row[g.revocationJobId] !== null ||
-          now < until
-        )
-          continue;
-
-        const a = mapping.admission,
-          d = mapping.command;
-
-        const references = both(
-          sql`not exists(select 1 from ${a.table} where ${equal(a.table, { [a.moduleId]: moduleId, [a.grantId]: context.grantId })})`,
-          sql`not exists(select 1 from ${d.table} where ${equal(d.table, { [d.moduleId]: moduleId, [d.grantId]: context.grantId })})`,
-          ...(j === undefined
-            ? []
-            : [
-                sql`not exists(select 1 from ${j.table} where ${equal(j.table, { [j.moduleId]: moduleId, [j.grantId]: context.grantId })})`,
-              ]),
-        );
-
-        if (!(yield* owner.check(references))) continue;
-        yield* owner.remove(g.table, {
-          [g.moduleId]: moduleId,
-          [g.grantId]: context.grantId,
-          [g.version]: grant.row[g.version],
-        });
-        owner.postconditions.push(references, sql`${mapping.clock.engineNowMillis} >= ${until}`);
-        removed++;
-      }
-    }
-    // Clearing is global remote authority, independent of the module which happens
-    // to run cleanup. No subject filter may hide a former owner's unresolved work.
-    if (visited < limit && j !== undefined) {
-      const candidates = { rows: discovered.cohorts };
-      const remaining = limit - visited;
-
-      if (candidates.rows.length > remaining) hasMore = true;
-      for (const candidate of candidates.rows.slice(0, remaining)) {
-        visited++;
-        const id = candidate[h.clientKey];
-        const client = yield* S.lockClientById(mapping, id);
-        const cohort = yield* S.cohort(mapping, id, candidate[h.identityKey], false);
-
-        invariant(cohort.id === candidate[h.cohortKey] && cohort.row !== undefined);
-        yield* C.clear(mapping, client, cohort);
-      }
-    }
-    if (visited < limit && mapping.externalReference !== undefined) {
-      const t = mapping.ownership.tuple,
-        remaining = limit - visited;
-
-      if (discovered.tuples.length > remaining) hasMore = true;
-      for (const candidate of discovered.tuples.slice(0, remaining)) {
-        visited++;
-        const scope = yield* S.heldScope(mapping, candidate[t.provider], candidate[t.issuer]);
-
-        if (scope === undefined) continue;
-
-        const identity = {
-          provider: candidate[t.provider],
-          issuer: candidate[t.issuer],
-          subject: candidate[t.externalSubject],
-        };
-
-        invariant((yield* oauthIdentityKey(identity)) === candidate[t.identityKey]);
-
-        const tuple = yield* F.inspectTuple(mapping, identity),
-          row = tuple.row;
-
-        if (row === undefined || row[t.state] !== "Owned") continue;
-        const native = row[t.subjectId];
-
-        invariant(native !== null);
-
-        const noRefs = both(
-          sql`not (${connectedReferenceCondition(mapping, tuple.key)})`,
-          sql`not (${mapping.externalReference({ identityKey: tuple.key, subjectId: S.nativeCopy(native) })})`,
-        );
-
-        if (!(yield* owner.check(noRefs))) continue;
-        yield* S.touchScope(mapping, scope);
-        yield* owner.update(
-          t.table,
-          { [t.identityKey]: tuple.key, [t.state]: "Owned", [t.subjectId]: native },
-          {
-            [t.state]: "Unowned",
-            [t.subjectId]: null,
-            [t.reservation]: null,
-            [t.version]: owner.marker,
-          },
-        );
-        if (mapping.ownership.mode === "separate")
-          yield* owner.remove(mapping.ownership.external.table, {
-            [mapping.ownership.external.identityKey]: tuple.key,
-          });
-        owner.postconditions.push(noRefs);
-      }
-    }
-
-    return { visited, removed, hasMore };
-  });
-
-  return { discover, collect };
-});
-
-export class OAuthConnectedCollection extends Context.Service<
-  OAuthConnectedCollection,
-  Effect.Success<typeof make>
->()("effect-auth/persistence/OAuthConnectedCollection") {
-  static readonly layer = Layer.effect(OAuthConnectedCollection, make);
-}

package/src/internal/oauth/connected-custody.ts

@@ -1,308 +0,0 @@
-import * as M from "@yielded/auth/OAuth";
-import { snapshotOAuthSync } from "@yielded/auth/OAuth";
-import { Effect, Context, Layer } from "effect";
-
-import type { SqlExpression as SQL } from "../query-operations";
-import { OAuthConnectedState } from "./connected-state";
-import type * as STypes from "./connected-state";
-import { CurrentOAuthTransaction } from "./owner";
-import { OAuthQueryCompiler } from "./query-compiler";
-import { invariant, oauthIdentityKey } from "./state";
-
-type Client = NonNullable<Effect.Success<ReturnType<OAuthConnectedState["Service"]["client"]>>>;
-
-type Cohort = Effect.Success<ReturnType<OAuthConnectedState["Service"]["cohort"]>>;
-
-const make = Effect.gen(function* () {
-  const operations = yield* OAuthQueryCompiler;
-  const S = yield* OAuthConnectedState;
-
-  const { eq, isNotNull, ne, sql } = operations;
-  const { both, col, equal } = operations;
-
-  const sameContext = (a: M.OAuthConnectedTokenContext, b: M.OAuthConnectedTokenContext) =>
-    S.tokenContextStorage.encode(a) === S.tokenContextStorage.encode(b);
-
-  const sameGrant = (a: M.OAuthConnectedStoredGrant, b: M.OAuthConnectedStoredGrant) =>
-    S.grantStorage.encode(a) === S.grantStorage.encode(b);
-
-  const summary = (context: M.OAuthConnectedTokenContext) =>
-    snapshotOAuthSync(M.OAuthConnectedSummary, {
-      grantId: context.grantId,
-      provider: context.identity.provider,
-      issuer: context.identity.issuer,
-      profileKey: context.configuration.profile.key,
-      status: "Active",
-      scopes: context.metadata.scopes,
-      ...(context.metadata.accessExpiresAtMillis === undefined
-        ? {}
-        : { accessExpiresAtMillis: context.metadata.accessExpiresAtMillis }),
-      useUntilMillis: context.metadata.useUntilMillis,
-      ...(context.metadata.profile === undefined ? {} : { profile: context.metadata.profile }),
-      remoteRevocation:
-        context.configuration.profile.revocation === "cohort" ? "Pending" : "Unsupported",
-    });
-
-  /** A generation fences every sibling, including those beyond a bounded metadata page. */
-  const fence = Effect.fn("oauthConnected.fence")(function* (
-    mapping: STypes.Authority,
-    client: Client,
-    cohort: Cohort,
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-
-    invariant(cohort.row !== undefined);
-
-    const g = mapping.grant,
-      h = mapping.cohort;
-
-    const active = both(
-      eq(col(g.table, g.cohortKey), cohort.id),
-      isNotNull(col(g.table, g.activeIdentityKey)),
-    );
-
-    const affected = yield* S.rowCount(g.table, active);
-
-    invariant(yield* owner.check(S.countCondition(g.table, active, affected)));
-    const cutoff = yield* S.nextOrder(mapping, client);
-    const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker);
-
-    yield* owner.update(
-      h.table,
-      { [h.cohortKey]: cohort.id },
-      {
-        [h.generation]: generation,
-        [h.cutoff]: mapping.order.encode(cutoff),
-        [h.state]: "Blocked",
-        [h.version]: owner.marker,
-      },
-    );
-    yield* owner.write(
-      owner.database
-        .update(g.table)
-        .set({
-          [g.activeIdentityKey]: null,
-          [g.state]: "ReauthorizationRequired",
-          [g.version]: owner.marker,
-        })
-        .where(active),
-    );
-    for (const observation of owner.observations)
-      if (observation.table === g.table)
-        observation.rows = observation.rows.map((row) =>
-          row[g.cohortKey] === cohort.id && row[g.activeIdentityKey] !== null
-            ? {
-                ...row,
-                [g.activeIdentityKey]: null,
-                [g.state]: "ReauthorizationRequired",
-                [g.version]: owner.marker,
-              }
-            : row,
-        );
-    owner.postconditions.push(sql`not exists(select 1 from ${g.table} where ${active})`);
-    cohort.generation = generation;
-    cohort.cutoff = cutoff;
-    cohort.blocked = true;
-
-    return affected;
-  });
-
-  const storeJob = Effect.fn("oauthConnected.storeJob")(function* (
-    mapping: STypes.Mapping,
-    job: M.OAuthConnectedRevocationJob,
-    token: M.OAuthConnectedTokenContext,
-    native: unknown,
-    now: number,
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-
-    invariant(
-      mapping.revocation.mode === "cohort" &&
-        token.configuration.profile.revocation === "cohort" &&
-        sameContext(job.context.token, token),
-    );
-
-    const j = mapping.revocation.job,
-      identity = yield* oauthIdentityKey(token.identity),
-      client = yield* S.clientKey(token.configuration),
-      cohort = yield* S.cohortKey(client, identity);
-
-    const h = mapping.cohort;
-
-    owner.postconditions.push(
-      sql`exists(select 1 from ${h.table} where ${both(equal(h.table, { [h.cohortKey]: cohort, [h.clientKey]: client, [h.identityKey]: identity, [h.state]: "Blocked" }))})`,
-    );
-    const key = { [j.jobId]: job.context.jobId };
-    const prior = yield* owner.read(j.table, equal(j.table, key), { limit: 1 });
-
-    if (prior.rows.length) {
-      const row = prior.rows[0]!;
-
-      invariant(
-        row[j.snapshot] === S.jobStorage.encode(job) &&
-          row[j.moduleId] === token.moduleId &&
-          mapping.subjectId.equals(row[j.subjectId], native) &&
-          row[j.identityKey] === identity &&
-          row[j.clientKey] === client &&
-          row[j.cohortKey] === cohort &&
-          row[j.grantId] === token.grantId &&
-          ["Pending", "Claimed", "Confirmed", "Unknown"].includes(row[j.state]),
-      );
-      invariant(
-        row[j.state] === "Pending"
-          ? row[j.claimId] === null && row[j.claimedAt] === null && row[j.claimExpiresAt] === null
-          : typeof row[j.claimId] === "string" &&
-              mapping.clock.decodeInstant(row[j.claimExpiresAt]) >
-                mapping.clock.decodeInstant(row[j.claimedAt]),
-      );
-
-      return;
-    }
-
-    const inserted = yield* owner.insert(
-      j.table,
-      {
-        ...j.encodeInsert({
-          job: snapshotOAuthSync(M.OAuthConnectedRevocationJob, job),
-          subjectId: S.nativeCopy(native),
-        }),
-        ...key,
-        [j.moduleId]: token.moduleId,
-        [j.subjectId]: native,
-        [j.identityKey]: identity,
-        [j.clientKey]: client,
-        [j.cohortKey]: cohort,
-        [j.grantId]: token.grantId,
-        [j.snapshot]: S.jobStorage.encode(job),
-        [j.state]: "Pending",
-        [j.claimId]: null,
-        [j.claimedAt]: null,
-        [j.claimExpiresAt]: null,
-        [j.retentionUntil]: mapping.clock.encodeInstant(S.retainedUntil(mapping, now)),
-        [j.version]: owner.marker,
-      },
-      key,
-    );
-
-    prior.rows = inserted.rows;
-  });
-
-  const noJobs = (mapping: STypes.Authority, id: string | SQL, except?: string) => {
-    const j = S.jobTable(mapping);
-
-    return j === undefined
-      ? sql`1 = 1`
-      : sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.cohortKey), id), ne(col(j.table, j.state), "Confirmed"), except === undefined ? undefined : ne(col(j.table, j.jobId), except))})`;
-  };
-
-  const clearableCondition = (
-    mapping: STypes.Authority,
-    cohortId: string | SQL,
-    clientId: string | SQL,
-  ) => {
-    const f = mapping.flow;
-
-    return both(
-      sql`not exists(select 1 from ${f.table} where ${S.unknownWork(mapping, clientId)})`,
-      S.cohortWork(mapping, cohortId),
-      noJobs(mapping, cohortId),
-    );
-  };
-
-  /** Clearing owns a NEW cutoff. Claims made while the remote revoke was pending
-   * cannot enter the next generation even if they finish after that revoke. */
-  const clear = Effect.fn("oauthConnected.clear")(function* (
-    mapping: STypes.Authority,
-    client: Client,
-    cohort: Cohort,
-    confirmedJob?: string,
-    provenOpenWithoutNewJob = false,
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-
-    if (
-      !cohort.blocked ||
-      cohort.row === undefined ||
-      (S.jobTable(mapping) === undefined && !provenOpenWithoutNewJob)
-    )
-      return false;
-    const f = mapping.flow;
-    const noUnknown = sql`not exists(select 1 from ${f.table} where ${S.unknownWork(mapping, client.id)})`;
-    const work = S.cohortWork(mapping, cohort.id);
-
-    if (!(yield* owner.check(both(noUnknown, work, noJobs(mapping, cohort.id, confirmedJob)))))
-      return false;
-
-    const cutoff = yield* S.nextOrder(mapping, client),
-      h = mapping.cohort;
-
-    const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker + ":open");
-
-    yield* owner.update(
-      h.table,
-      { [h.cohortKey]: cohort.id },
-      {
-        [h.generation]: generation,
-        [h.cutoff]: mapping.order.encode(cutoff),
-        [h.state]: "Open",
-        [h.version]: owner.marker,
-      },
-    );
-    owner.postconditions.push(noUnknown, work, noJobs(mapping, cohort.id));
-    cohort.generation = generation;
-    cohort.cutoff = cutoff;
-    cohort.blocked = false;
-
-    return true;
-  });
-
-  /** Former local owners remain visible. A foreign historical dependency cannot be
-   * ignored simply because the global tuple was changed outside this authority. */
-  const noFormerOwner = (
-    mapping: STypes.Authority,
-    identity: string,
-    client: string,
-    native: unknown,
-  ) =>
-    Effect.gen(function* () {
-      const owner = yield* CurrentOAuthTransaction;
-
-      const g = mapping.grant,
-        f = mapping.flow,
-        j = S.jobTable(mapping);
-
-      const condition = both(
-        sql`not exists(select 1 from ${g.table} where ${both(eq(col(g.table, g.identityKey), identity), sql`not (${owner.exact(g.table, { [g.subjectId]: native })})`)})`,
-        sql`not exists(select 1 from ${f.table} where ${both(eq(col(f.table, f.cohortKey), yield* S.cohortKey(client, identity)), eq(col(f.table, f.work), "Unresolved"), sql`not (${owner.exact(f.table, { [f.subjectId]: native })})`)})`,
-        ...(j === undefined
-          ? []
-          : [
-              sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.identityKey), identity), sql`not (${owner.exact(j.table, { [j.subjectId]: native })})`)})`,
-            ]),
-      );
-
-      return yield* Effect.map(owner.check(condition), (accepted) => {
-        if (accepted) owner.postconditions.push(condition);
-
-        return accepted;
-      });
-    });
-
-  return {
-    sameContext,
-    sameGrant,
-    summary,
-    fence,
-    storeJob,
-    clearableCondition,
-    clear,
-    noFormerOwner,
-  };
-});
-
-export class OAuthConnectedCustody extends Context.Service<
-  OAuthConnectedCustody,
-  Effect.Success<typeof make>
->()("effect-auth/persistence/OAuthConnectedCustody") {
-  static readonly layer = Layer.effect(OAuthConnectedCustody, make);
-}